Brocade Communications Systems Brocade 8/12c Service manual

53-1002159-03
28 July 2011
®
53-1002159-03
Fabric OS Encryption
Administrator’s Guide Supporting
HP Secure Key Manager (SKM)
Environments and HP Enterprise Secure
Key Manager (ESKM) Environments
Supporting Fabric OS v7.0.0

Copyright © 2010-2011 Brocade Communications Systems, Inc. All Rights Reserved.
Brocade, the B-wing symbol, BigIron, DCX, Fabric OS, FastIron, IronPoint, IronShield, IronView, IronWare, JetCore, NetIron,
SecureIron, ServerIron, StorageX, and TurboIron are registered trademarks, and DCFM, Extraordinary Networks, and SAN Health
are trademarks of Brocade Communications Systems, Inc., in the United States and/or in other countries. All other brands,
products, or service names are or may be trademarks or service marks of, and are used to identify, products or services of their
respective owners.
Notice: This document is for informational purposes only and does not set forth any warranty, expressed or implied, concerning
any equipment, equipment feature, or service offered or to be offered by Brocade. Brocade reserves the right to make changes to
this document at any time, without notice, and assumes no responsibility for its use. This informational document describes
features that may not be currently available. Contact a Brocade sales office for information on feature and product availability.
Export of technical data contained in this document may require an export license from the United States government.
The authors and Brocade Communications Systems, Inc. shall have no liability or responsibility to any person or entity with
respect to any loss, cost, liability, or damages arising from the information contained in this book or the computer programs that
accompany it.
The product described by this document may contain “open source” software covered by the GNU General Public License or other
open source license agreements. To find out which open source software is included in Brocade products, view the licensing
terms applicable to the open source software, and obtain a copy of the programming source code, please visit
http://www.brocade.com/support/oscd.
Brocade Communications Systems, Incorporated
Document History
Corporate and Latin American Headquarters
Brocade Communications Systems, Inc.
130 Holger Way
San Jose, CA 95134
Tel: [phone]
Fax: [phone]
E-mail: inf[email protected]
Asia-Pacific Headquarters
Brocade Communications Systems China HK, Ltd.
No. 1 Guanghua Road
Chao Yang District
Units 2718 and 2818
Beijing 100020, China
Tel: [phone]
Fax: [phone]
E-mail: [email protected]
European Headquarters
Brocade Communications Switzerland Sàrl
Centre Swissair
Tour B - 4ème étage
29, Route de l'Aéroport
Case Postale 105
CH-1215 Genève 15
Switzerland
Tel: [phone]
Fax: [phone]
E-mail: [e-mail]
Asia-Pacific Headquarters
Brocade Communications Systems Co., Ltd. (Shenzhen WFOE)
Citic Plaza
No. 233 Tian He Road North
Unit 1308 – 13th Floor
Guangzhou, China
Tel: [phone]
Fax: [phone]
E-mail: [email protected]
Title Publication number Summary of changes Date
Fabric OS Encryption Administrator’s
Guide for SKM Environments
53-1001864-01 New product release March 2010
Fabric OS Encryption Administrator’s
Guide for SKM Environments
53-1001864-02 Maintenance release November 2010
Fabric OS Encryption Administrator’s
Guide for SKM Environments
53-1002159-01 Revised to support new
features
April 2011
Fabric OS Encryption Administrator’s
Guide for SKM Environments
53-1002159-02 Maintenance release June 2011
Fabric OS Encryption Administrator’s
Guide for SKM Environments
53-1002159-03 Added support for ESKM July 2011

Fabric OS Encryption Administrator’s Guide iii
53-1002159-03

iv Fabric OS Encryption Administrator’s Guide
53-1002159-03

Fabric OS Encryption Administrator’s Guide v
53-1002159-03
Contents
About This Document
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii
How this document is organized . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii
Supported hardware and software . . . . . . . . . . . . . . . . . . . . . . . . . . xiv
What’s new in this document. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv
Document conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv
Notice to the reader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi
Additional information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi
Getting technical help. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xvii
Document feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xviii
Chapter 1 Encryption Overview
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Host and LUN considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
The Brocade Encryption Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
The FS8-18 blade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
FIPS mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Performance licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Adding a license. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Licensing best practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Recommendation for connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Usage limitations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Brocade encryption solution overview. . . . . . . . . . . . . . . . . . . . . . . . . 7
Data flow from server to storage . . . . . . . . . . . . . . . . . . . . . . . . . 8
Data encryption key life cycle management . . . . . . . . . . . . . . . . . . . . 9
Master key management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Master key generation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Master key backup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Support for Virtual Fabrics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Cisco Fabric Connectivity support . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

vi Fabric OS Encryption Administrator’s Guide
53-1002159-03
Chapter 2 Encryption configuration
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Encryption Center features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Encryption user privileges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Smart card usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Registering authentication cards from a card reader . . . . . . . . 16
Registering authentication cards from the database . . . . . . . . 18
Deregistering an authentication card. . . . . . . . . . . . . . . . . . . . .19
Using authentication cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20
Enabling or disabling the system card requirement . . . . . . . . .20
Registering system cards from a card reader . . . . . . . . . . . . . . 21
Deregistering a system card . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Tracking smart cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22
Editing smart cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Network connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Configuring blade processor links . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Encryption node initialization and certificate generation. . . . . . . . .25
Steps for connecting to an SKM or ESKM appliance . . . . . . . . . . . .26
Configuring a Brocade group on SKM or ESKM. . . . . . . . . . . . . 27
Registering the SKM or ESKM Brocade group user name
and password. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28
Setting up the local Certificate Authority (CA) on SKM or
ESKM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Downloading the local CA certificate from SKM or ESKM . . . .30
Creating and installing the SKM or ESKM server certificate . .30
Enabling SSL on the Key Management System (KMS)
Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Creating an SKM or ESKM High Availability cluster. . . . . . . . . . 32
Copying the local CA certificate for a clustered SKM or
ESKM appliance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Adding SKM or ESKM appliances to the cluster . . . . . . . . . . . .33
Signing the Brocade encryption node KAC certificates. . . . . . .34
Importing a signed KAC certificate into a switch . . . . . . . . . . . . 35
SKM or ESKM key vault high availability deployment . . . . . . . .36
Steps for Migrating from SKM to ESKM. . . . . . . . . . . . . . . . . . . . . . .36
Steps required from the BES CLI . . . . . . . . . . . . . . . . . . . . . . . .36
Steps required using Brocade Management application . . . . . 37
Encryption preparation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .38
Creating a new encryption group . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Understanding configuration status results. . . . . . . . . . . . . . . . 46
Adding a switch to an encryption group. . . . . . . . . . . . . . . . . . . . . . . 47
Replacing an encryption engine in an encryption group . . . . . . . . . 53

Fabric OS Encryption Administrator’s Guide vii
53-1002159-03
Creating high availability (HA) clusters . . . . . . . . . . . . . . . . . . . . . . .54
Removing engines from an HA cluster . . . . . . . . . . . . . . . . . . . . 55
Swapping engines in an HA cluster . . . . . . . . . . . . . . . . . . . . . . 55
Failback option. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Invoking failback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Adding encryption targets. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Configuring hosts for encryption targets . . . . . . . . . . . . . . . . . . . . . . 64
Adding target disk LUNs for encryption . . . . . . . . . . . . . . . . . . . . . . . 65
Configuring Storage Arrays . . . . . . . . . . . . . . . . . . . . . . . . . . . . .68
Adding target tape LUNs for encryption. . . . . . . . . . . . . . . . . . . . . . .68
Tape LUN write early and read ahead . . . . . . . . . . . . . . . . . . . . . . . . 71
Enabling and disabling tape LUN write early and read
ahead . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Tape LUN statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73
Viewing and clearing tape container statistics . . . . . . . . . . . . . 73
Viewing and clearing tape LUN statistics for a container . . . . . 74
Viewing and clearing statistics for specific tape LUNs . . . . . . . 75
Re-balancing the encryption engine . . . . . . . . . . . . . . . . . . . . . . . . . 77
Master keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .78
Active master key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Alternate master key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .78
Master key actions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .79
Reasons master keys can be disabled. . . . . . . . . . . . . . . . . . . .79
Saving the master key to a file . . . . . . . . . . . . . . . . . . . . . . . . . .79
Saving a master key to a key vault . . . . . . . . . . . . . . . . . . . . . . . 81
Saving a master key to a smart card set . . . . . . . . . . . . . . . . . .82
Restoring a master key from a file . . . . . . . . . . . . . . . . . . . . . . . 84
Restoring a master key from a key vault . . . . . . . . . . . . . . . . . .85
Restoring a master key from a smart card set. . . . . . . . . . . . . . 86
Creating a new master key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Viewing master key IDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Zeroizing an encryption engine . . . . . . . . . . . . . . . . . . . . . . . . . . . . .88
Using the Encryption Targets dialog box . . . . . . . . . . . . . . . . . . . . . .90
Redirection zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Re-keying all disk LUNs manually. . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Viewing the progress of manual re-key operations . . . . . . . . . .93
Viewing time left for auto re-key. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Viewing and editing switch encryption properties . . . . . . . . . . . . . . 95
Exporting the public key certificate signing request (CSR)
from Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Importing a signed public key certificate from Properties . . . . 97
Enabling and disabling the encryption engine state from
Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

viii Fabric OS Encryption Administrator’s Guide
53-1002159-03
Viewing and editing group properties . . . . . . . . . . . . . . . . . . . . . . . . 98
General tab. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Members tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .100
Consequences of removing an encryption switch . . . . . . . . . .101
Security tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .103
HA Clusters tab. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .104
Tape Pools tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .105
Engine Operations tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107
Encryption-related acronyms in log messages . . . . . . . . . . . . . . . .109
Chapter 3 Configuring Brocade Encryption Using the CLI
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .111
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .112
Command validation checks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .112
Command RBAC permissions and AD types . . . . . . . . . . . . . . . . . .113
Cryptocfg Help command output . . . . . . . . . . . . . . . . . . . . . . . . . . .115
Management LAN configuration . . . . . . . . . . . . . . . . . . . . . . . . . . .116
Configuring cluster links . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116
Special consideration for blades . . . . . . . . . . . . . . . . . . . . . . . 117
IP Address change of a node within an encryption group. . . .117
Steps for connecting to an SKM or ESKM appliance . . . . . . . . . . .119
Configuring a Brocade group. . . . . . . . . . . . . . . . . . . . . . . . . . .119
Setting up the local Certificate Authority (CA) . . . . . . . . . . . . .120
Downloading the local CA certificate . . . . . . . . . . . . . . . . . . . .121
Creating and installing the SKM or ESKM server
certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .122
Enabling SSL on the Key Management System (KMS)
Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .123
Creating an SKM or ESKM high availability cluster . . . . . . . . .124
Copying the local CA certificate. . . . . . . . . . . . . . . . . . . . . . . . .124
Adding SKM or ESKM appliances to the cluster . . . . . . . . . . .125
Initializing the Brocade encryption engines . . . . . . . . . . . . . . .126
Signing the Brocade encryption node KAC certificates. . . . . .127
Registering SKM or ESKM on a Brocade encryption group
leader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .128
Registering the SKM or ESKM Brocade group user name
and password. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .130
SKM or ESKM key vault high availability deployment . . . . . . .131
Adding a member node to an encryption group . . . . . . . . . . .132
Generating and backing up the master key . . . . . . . . . . . . . . . . . .135
High availability cluster configuration . . . . . . . . . . . . . . . . . . . . . . .137
HA cluster configuration rules. . . . . . . . . . . . . . . . . . . . . . . . . .137
Creating an HA cluster. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .138
Adding an encryption engine to an HA cluster . . . . . . . . . . . . .139
Failover/failback policy configuration. . . . . . . . . . . . . . . . . . . .139

Fabric OS Encryption Administrator’s Guide ix
53-1002159-03
Re-exporting a master key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .140
Exporting an additional key ID . . . . . . . . . . . . . . . . . . . . . . . . . 141
Viewing the master key IDs . . . . . . . . . . . . . . . . . . . . . . . . . . . .142
Enabling the encryption engine . . . . . . . . . . . . . . . . . . . . . . . . . . . .143
Checking encryption engine status . . . . . . . . . . . . . . . . . . . . .143
Zoning considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .144
Setting default zoning to no access . . . . . . . . . . . . . . . . . . . . .144
Frame redirection zoning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .145
Creating an initiator - target zone . . . . . . . . . . . . . . . . . . . . . . .145
CryptoTarget container configuration . . . . . . . . . . . . . . . . . . . . . . . 147
LUN re-balancing when hosting both disk and tape
targets. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .148
Gathering information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .149
Creating a CryptoTarget container . . . . . . . . . . . . . . . . . . . . . .149
Removing an initiator from a CryptoTarget container . . . . . . .151
Deleting a CryptoTarget container . . . . . . . . . . . . . . . . . . . . . .152
Moving a CryptoTarget container . . . . . . . . . . . . . . . . . . . . . . .153
Crypto LUN configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .153
Discovering a LUN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .154
Configuring a Crypto LUN . . . . . . . . . . . . . . . . . . . . . . . . . . . . .154
Crypto LUN parameters and policies . . . . . . . . . . . . . . . . . . . .156
Configuring a tape LUN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .158
Removing a LUN from a CryptoTarget container . . . . . . . . . . .159
Modifying Crypto LUN parameters . . . . . . . . . . . . . . . . . . . . . .160
LUN modification considerations . . . . . . . . . . . . . . . . . . . . . . . 161
Impact of tape LUN configuration changes. . . . . . . . . . . . . . . . . . .161
Force-enabling a disabled disk LUN for encryption . . . . . . . . .162
Tape pool configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162
Tape pool labeling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162
Creating a tape pool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .164
Deleting a tape pool. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .165
Modifying a tape pool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .165
Impact of tape pool configuration changes . . . . . . . . . . . . . . .166
Configuring a multi-path Crypto LUN . . . . . . . . . . . . . . . . . . . . . . . .166
Multi-path LUN configuration example . . . . . . . . . . . . . . . . . . .166
First-time encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .169
Resource allocation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .170
First time encryption modes . . . . . . . . . . . . . . . . . . . . . . . . . . .170
Configuring a LUN for first time encryption . . . . . . . . . . . . . . .170
Data re-keying . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .170
Resource Allocation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
Re-keying modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
Configuring a LUN for automatic re-keying. . . . . . . . . . . . . . . . 171
Initiating a manual re-key session . . . . . . . . . . . . . . . . . . . . . .172
Suspension and resumption of re-keying operations . . . . . . .173

xFabric OS Encryption Administrator’s Guide
53-1002159-03
Chapter 4 Deployment Scenarios
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .175
Single encryption switch, two paths from host to target . . . . . . . . 176
Single fabric deployment - HA cluster . . . . . . . . . . . . . . . . . . . . . . . 177
Single fabric deployment - DEK cluster . . . . . . . . . . . . . . . . . . . . . .178
Dual fabric deployment - HA and DEK cluster. . . . . . . . . . . . . . . . .179
Multiple paths, one DEK cluster, and two HA clusters . . . . . . . . . .180
Multiple paths, DEK cluster, no HA cluster . . . . . . . . . . . . . . . . . . .182
Deployment in Fibre Channel routed fabrics. . . . . . . . . . . . . . . . . .183
Deployment as part of an edge fabric . . . . . . . . . . . . . . . . . . . . . . .185
Deployment with FCIP extension switches . . . . . . . . . . . . . . . . . . .186
VMware ESX server deployments. . . . . . . . . . . . . . . . . . . . . . . . . . .187
Chapter 5 Best Practices and Special Topics
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .189
Firmware download considerations . . . . . . . . . . . . . . . . . . . . . . . . .190
Firmware upgrades and downgrades . . . . . . . . . . . . . . . . . . . .190
Data-at-rest encryption support for IBM SVC LUNs
configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191
Specific guidelines for HA clusters . . . . . . . . . . . . . . . . . . . . . .191
Configuration upload and download considerations . . . . . . . . . . .192
Configuration upload at an encryption group leader node . . .192
Configuration upload at an encryption group member
node . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .193
Information not included in an upload . . . . . . . . . . . . . . . . . . .193
Steps before configuration download. . . . . . . . . . . . . . . . . . . .193
Configuration download at the encryption group leader. . . . .194
Configuration download at an encryption group member . . .194
Steps after configuration download . . . . . . . . . . . . . . . . . . . . .194
HP-UX considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .195
AIX Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .195
Enable of a disabled LUN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .195
Disk metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .195
Tape metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .196
Tape data compression . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .196
Tape pools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .196
Tape block zero handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .197
Tape key expiry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .197
Configuring CryptoTarget containers and LUNs . . . . . . . . . . . . . . .197
Redirection zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .198
Deployment with Admin Domains (AD) . . . . . . . . . . . . . . . . . . . . . .199

Fabric OS Encryption Administrator’s Guide xi
53-1002159-03
Do not use DHCP for IP interfaces . . . . . . . . . . . . . . . . . . . . . . . . . .199
Ensure uniform licensing in HA clusters . . . . . . . . . . . . . . . . . . . . .199
Tape library media changer considerations . . . . . . . . . . . . . . . . . .199
Turn off host-based encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . .199
Avoid double encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .199
PID failover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .200
Turn off compression on extension switches . . . . . . . . . . . . . . . . .200
Re-keying best practices and policies . . . . . . . . . . . . . . . . . . . . . . .200
Manual re-key. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .200
Latency in re-key operations . . . . . . . . . . . . . . . . . . . . . . . . . . .200
Allow re-key to complete before deleting a container . . . . . . .201
Re-key operations and firmware upgrades . . . . . . . . . . . . . . .201
Do not change LUN configuration while re-keying. . . . . . . . . .201
Recommendation for Host I/O traffic during online
rekeying and first time encryption . . . . . . . . . . . . . . . . . . . . . .201
KAC certificate registration expiry . . . . . . . . . . . . . . . . . . . . . . . . . .201
Changing IP addresses in encryption groups . . . . . . . . . . . . . . . . .202
Disabling the encryption engine . . . . . . . . . . . . . . . . . . . . . . . . . . .202
Recommendations for Initiator Fan-Ins . . . . . . . . . . . . . . . . . . . . . .202
Best practices for host clusters in an encryption environment . . .204
HA Cluster deployment considerations and best practices . . . . . .204
Key Vault Best Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .204
Tape Device LUN Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .204
Chapter 6 Maintenance and Troubleshooting
In this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .205
Encryption group and HA cluster maintenance. . . . . . . . . . . . . . . .205
Displaying encryption group configuration or status
information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .205
Removing a member node from an encryption group. . . . . . .206
Deleting an encryption group . . . . . . . . . . . . . . . . . . . . . . . . . .208
Removing an HA cluster member . . . . . . . . . . . . . . . . . . . . . . .208
Displaying the HA cluster configuration . . . . . . . . . . . . . . . . . .208
Replacing an HA cluster member . . . . . . . . . . . . . . . . . . . . . . .209
Deleting an HA cluster member . . . . . . . . . . . . . . . . . . . . . . . .211
Performing a manual failback of an encryption engine . . . . .212

xii Fabric OS Encryption Administrator’s Guide
53-1002159-03
Encryption group merge and split use cases . . . . . . . . . . . . . . . . .213
A member node failed and is replaced . . . . . . . . . . . . . . . . . .213
A member node reboots and comes back up . . . . . . . . . . . . .214
A member node lost connection to the group leader . . . . . . .215
A member node lost connection to all other nodes in the
encryption group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .215
Several member nodes split off from an encryption group . .216
Adjusting heartbeat signaling values . . . . . . . . . . . . . . . . . . . . 217
EG split possibilities requiring manual recovery . . . . . . . . . . .217
Configuration impact of encryption group split or node
isolation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .222
Encryption group database manual operations . . . . . . . . . . . . . . .223
Manually synchronizing the encryption group database. . . . .223
Manually synchronizing the security database . . . . . . . . . . . .223
Aborting a pending database transaction . . . . . . . . . . . . . . . .223
Key vault diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .223
General encryption troubleshooting . . . . . . . . . . . . . . . . . . . . . . . .226
Troubleshooting examples using the CLI . . . . . . . . . . . . . . . . . . . . .229
Encryption Enabled Crypto Target LUN. . . . . . . . . . . . . . . . . . .229
Encryption Disabled Crypto Target LUN . . . . . . . . . . . . . . . . . .230
Management application encryption wizard troubleshooting . . . .231
Errors related to adding a switch to an existing group . . . . . .231
Errors related to adding a switch to a new group . . . . . . . . . .232
General errors related to the Configure Switch Encryption
wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .233
LUN policy troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .234
Loss of encryption group leader after power outage . . . . . . . . . . .235
MPIO and internal LUN states . . . . . . . . . . . . . . . . . . . . . . . . . . . . .236
Suspension and resumption of re-keying operations . . . . . . .236
FS8-18 blade removal and replacement. . . . . . . . . . . . . . . . . . . . .237
BES removal and replacement. . . . . . . . . . . . . . . . . . . . . . . . . . . . .238
Multi Node EG Case. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .238
Single Node EG Replacement . . . . . . . . . . . . . . . . . . . . . . . . . .242
Reclaiming the WWN base of a failed Brocade Encryption
Switch. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .244
Splitting an encryption group into two encryption groups . . . . . . .244
Moving a blade from one EG to another EG in the same fabric. . .245
Moving a BES from one EG to another EG in the same fabric . . . .246
Removing stale rekey information for a LUN. . . . . . . . . . . . . . . . . . 247
Appendix A State and Status Information
In this appendix. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .249
Encryption engine security processor (SP) states. . . . . . . . . . . . . .249

Fabric OS Encryption Administrator’s Guide xiii
53-1002159-03
Security processor KEK status. . . . . . . . . . . . . . . . . . . . . . . . . . . . .250
Encrypted LUN states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .250
Index

xiv Fabric OS Encryption Administrator’s Guide
53-1002159-03

Fabric OS Encryption Administrator’s Guide xiii
53-1002159-03
About This Document
In this chapter
•How this document is organized . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii
•Supported hardware and software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv
•What’s new in this document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv
•Document conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv
•Text formatting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiv
•Command syntax conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
•Key terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
•Notice to the reader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi
•Additional information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi
•Brocade resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi
•Other industry resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii
•Getting technical help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii
•Document feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xviii
How this document is organized
.This document is organized to help you find the information that you want as quickly and easily as
possible.
The document contains the following components:
•Chapter 1, “Encryption Overview,” provides a task matrix, an overview of the data encryption
switch and the encryption solution, and the terminology used in this document.
•Chapter 2, “Encryption configuration using the Management application,” describes how to
configure and manage encryption features using Brocade Network Advisor.
•Chapter 3, “Configuring Brocade Encryption Using the CLI,” describes how to configure and
manage encryption features using the command line interface.
•Chapter 4, “Deployment Scenarios,” describes SAN configurations in which encryption may be
deployed.
•Chapter 5, “Best Practices and Special Topics,” summarizes best practices and addresses
special topics relevant to the implementation of encryption features.

xiv Fabric OS Encryption Administrator’s Guide
53-1002159-03
•Chapter 6, “Maintenance and Troubleshooting,” provides information on troubleshooting and
the most common commands and procedures to use to diagnose and recover from problems.
•Appendix A, “State and Status Information,” lists the encryption engine security processor (SP)
states, security processor key encryption key (KEK) status information, and encrypted LUN
states.
Supported hardware and software
.The following hardware platforms support data encryption as described in this manual.
•Brocade DCX and DCX-4S with an FS8-18 encryption blade.
•Brocade Encryption Switch.
What’s new in this document
The purpose of this release is to note that HP Enterprise Secure Key Manager (ESKM) is now
supported.
Document conventions
This section describes text formatting conventions and important notice formats used in this
document.
Text formatting
The narrative-text formatting conventions that are used are as follows:
bold text Identifies command names
Identifies the names of user-manipulated GUI elements
Identifies keywords and operands
Identifies text to enter at the GUI or CLI
italic text Provides emphasis
Identifies variables
Identifies paths and Internet addresses
Identifies document titles
code text Identifies CLI output
Identifies command syntax examples
For readability, command names in the narrative portions of this guide are presented in mixed
lettercase: for example, switchShow. In actual examples, command lettercase is often all
lowercase. Otherwise, this manual specifically notes those cases in which a command is case
sensitive.

Fabric OS Encryption Administrator’s Guide xv
53-1002159-03
Command syntax conventions
Command syntax in this manual follows these conventions:
Notes, cautions, and warnings
The following notices and statements are used in this manual. They are listed below in order of
increasing severity of potential hazards.
NOTE
A note provides a tip, guidance or advice, emphasizes important information, or provides a reference
to related information.
ATTENTION
An Attention statement indicates potential damage to hardware or data.
CAUTION
A Caution statement alerts you to situations that can cause damage to hardware, firmware,
software, or data.
DANGER
A Danger statement indicates conditions or situations that can be potentially lethal or extremely
hazardous to you. Safety labels are also attached directly to products to warn of these conditions
or situations.
Key terms
For definitions specific to Brocade and Fibre Channel, see the technical glossaries on Brocade
Connect. See “Brocade resources” on page xvi for instructions on accessing MyBrocade.
command Commands are printed in bold.
--option, option Command options are printed in bold.
-argument, arg Arguments.
[ ] Optional element.
variable Variables are printed in italics. In the help pages, variables are underlined or
enclosed in angled brackets < >.
... Repeat the previous element, for example “member[;member...]”
value Fixed values following arguments are printed in plain font. For example,
--show WWN
| Boolean. Elements are exclusive. Example: --show -mode egress | ingress
\ Backslash. Indicates that the line continues through the line break. For
command line input, type the entire line without the backslash.

xvi Fabric OS Encryption Administrator’s Guide
53-1002159-03
For definitions specific to this document, see “Terminology” on page 2.
For definitions of SAN-specific terms, visit the Storage Networking Industry Association online
dictionary at:
http://www.snia.org/education/dictionary
Notice to the reader
This document may contain references to the trademarks of the following corporations. These
trademarks are the properties of their respective companies and corporations.
These references are made for informational purposes only.
Additional information
This section lists additional Brocade and industry-specific documentation that you might find
helpful.
Brocade resources
To get up-to-the-minute information, go to http://my.brocade.com and register at no cost for a user
ID and password.
For practical discussions about SAN design, implementation, and maintenance, you can obtain
Building SANs with Brocade Fabric Switches through:
http://www.amazon.com
For additional Brocade documentation, visit the Brocade SAN Info Center and click the Resource
Library location:
http://www.brocade.com
Corporation Referenced Trademarks and Products
IBM Tivoli Key Lifecycle Manager (TKLM)
IBM IBM Tivoli Storage Manager (TSM)
Microsoft Corporation Windows, Windows NT, Internet Explorer
Net App Lifetime Key Manager (LKM)
EMC RSA Key Manager (RKM)
Hewlett Packard Secure Key Manager (SKM)
Hewlett Packard Enterprise Secure Key Manager (ESKM)
Thales Thales Encryption Manager for Storage (TEMS)
EMC EMC Networker
Symantec Symantec Veritas NetBackup Enterprise Server
CommVault CommVault Galaxy Data Protection

Fabric OS Encryption Administrator’s Guide xvii
53-1002159-03
Release notes are available on the MyBrocade website and are also bundled with the Fabric OS
firmware.
Other industry resources
•White papers, online demos, and data sheets are available through the Brocade website at
http://www.brocade.com/products-solutions/products/index.page.
•Best practice guides, white papers, data sheets, and other documentation is available through
the Brocade Partner website.
For additional resource information, visit the Technical Committee T11 Web site. This website
provides interface standards for high-performance and mass storage applications for Fibre
Channel, storage management, and other applications:
http://www.t11.org
For information about the Fibre Channel industry, visit the Fibre Channel Industry Association
website:
http://www.fibrechannel.org
Getting technical help
Contact your switch support supplier for hardware, firmware, and software support, including
product repairs and part ordering. To expedite your call, have the following information available:
1. General Information
•Switch model
•Switch operating system version
•Error numbers and messages received
•supportSave command output
•Detailed description of the problem, including the switch or fabric behavior immediately
following the problem, and specific questions
•Description of any troubleshooting steps already performed and the results
•Serial console and Telnet session logs
•syslog message logs
2. Switch Serial Number
The switch serial number and corresponding bar code are provided on the serial number label,
as illustrated below.:
*FT00X0054E9*
FT00X0054E9

xviii Fabric OS Encryption Administrator’s Guide
53-1002159-03
The serial number label is located as follows:
•Brocade Encryption Switch—On the switch ID pull-out tab located inside the chassis on the
port side of the switch on the left.
•Brocade DCX—On the bottom right on the port side of the chassis
•Brocade DCX-4S—On the bottom right on the port side of the chassis, directly above the
cable management comb.
3. World Wide Name (WWN)
Use the licenseIdShow command to display the WWN of the chassis.
If you cannot use the licenseIdShow command because the switch is inoperable, you can get
the WWN from the same place as the serial number, except for the Brocade DCX. For the
Brocade DCX, access the numbers on the WWN cards by removing the Brocade logo plate at
the top of the non-port side of the chassis.
Document feedback
Quality is our first concern at Brocade and we have made every effort to ensure the accuracy and
completeness of this document. However, if you find an error or an omission, or you think that a
topic needs further development, we want to hear from you. Forward your feedback to:
[e-mail]
Provide the title and version number of the document and as much detail as possible about your
comment, including the topic heading and page number and your suggestions for improvement.